Remember how to design a password better?

For example, I want to know how to design the password, including the security risks after saving the function password. What should I save in the cookie? How can I encrypt the cookie to ensure security. For example, want to know

1. Remember how to design the password is good, including functions
2. Security risks after the password is saved
3. What needs to be saved in cookies?
4. How to encrypt cookies to ensure security

I hope you can explain it in detail.

Reply content:

For example, want to know

1. Remember how to design the password is good, including functions
2. Security risks after the password is saved
3. What needs to be saved in cookies?
4. How to encrypt cookies to ensure security

I hope you can explain it in detail.

Google's design can be followed.

1. Almost permanently remember the user name, and password should be re-written at intervals.
2. Login token is used (the token can be encrypted using the login name, password, or the attacker corresponding to the server ), this allows hackers to log on even if they have no password. (The former may be permanently used, and the latter may follow the policies of the past time and server)
3. We recommend that you do not use the encrypted name or secret, even if it is encrypted. Only one token generated by the full host is saved. The server not only saves the token, but also saves the IP address, UserAgent, and other information of the Peer. Once the device changes, it expires (for example, 8 hours ), you need to rebind the password.
4. The best "encryption" is that there is no authentication. All the tokens are on the server side, and the token is useless.

Remember, do not use encryption as secure. Even if you cannot crack the algorithm itself, there are also many different attacks. If you use the encrypted form to encrypt the domain name, it can be used as the only domain name for login. This ciphertext "itself" is the plaintext that can be used for login.

Charge: security cannot exist. Therefore, the tasks created by login are not classified as security protection information, instead, the license may not introduce new vulnerabilities by the login mechanism itself.

Simply put, you can encrypt the user name and save it. For example, md5 + salt. To ensure security, you can add an expiration time.